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Top Stories 

• Duke Energy agreed to pay Virginia $2.5 million in an April 3 settlement for its February 
2014 coal ash spill where a retired power plant in Eden dumped up to 39,000 tons of ash 
into the Dan River. - Charlotte Observer (See item 3) 

• The White River bridge on Highway 410 in Washington was closed April 4 for emergency 
repairs lasting several days following a routine inspection that revealed damage to an 
overhead support structure. - Seattle Times (See item 1A) 

• Heavy rain and melting snow led to a discharge of an estimated 90,000 gallons of untreated 
sewage into the Silver Lake Outlet from a sewage treatment plant in Perry, New York, 
April 4. - WXXI 21 Rochester (See item 21) 

• Auburn University in Alabama announced April 3 that the personal information of about 
370,000 current, former, and prospective students may have been exposed after the 
university learned that some information stored on the school’s servers inadvertently 
became accessible online. - Alcorn (See item 24) 
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Energy Sector 



1. April 5, WJW 8 Cleveland - (Ohio) Officials continue to investigate unknown 
substance found in Lake Erie. Crews continued April 5 to clean up an unknown 
substance that was released into Lake Erie from an outflow pipe at the Cleveland 
Public Power Plant following the recovering of about 2,900 gallons of an oily water 
mixture. Officials are testing the substance and continue to investigate the spill. 

Source: http://fox8.com/2015/04/05/officials-continue-to-investigate-unknown- 
substance-found-in-lake-erie/ 

2. April 4, Youngstown Vindicator - (Ohio) OEPA: 2,000 gallons of waste oil spilled 
into Vienna wetlands. Operations at Kleese Development’s Vienna, Ohio facility were 
halted April 3 until further notice following an estimated 2,000 gallon or more spill of 
light waste oil from a buried drain pipe that leaked into 2 ponds and the Little Yankee 
Run wetlands. Crews worked to clean up the areas impacted by the spill and authorities 
are investigating the incident. 

Source: http://www.vindv.com/news/2015/apr/04/oil-spill-cleanup-continues-in-vienna/ 

3. April 3, Charlotte Observer - (Virginia) Duke Energy to pay Virginia $2.5 million 
for Dan River spill. The Virginia Department of Environmental Quality announced 
April 3 that Duke Energy agreed to pay Virginia $2.5 million in a settlement for its 
February 2014 coal ash spill into the Dan River where a retired power plant in Eden 
dumped up to 39,000 tons of ash into the river. Authorities are continuing to monitor 
water quality and any potential long-term effects. 

Source: http://www.charlotteobserver.com/news/local/articlel7313746.html 
For another story, see item 30 
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Chemical Industry Sector 

4. April 3, Associated Press - (Pennsylvania) Dyno Nobel closing Donora chemical 
plant. Officials announced April 3 that the Dyno Nobel chemical plant in Donora will 
close May 1 due to economic constraints in the borough and that the company will 
periodically review whether to resume operations if the demand for ammonium nitrate 
increases. 

Source: http://powersource.post-gazette.com/powersource/companies- 
powersource/2015/04/03/Dvno-Nobel-closing-Donora-plant-pittsburgh- 
mining/stories/20 1504030284 

[ Return to top ] 

Nuclear Reactors, Materials, and Waste Sector 

Nothing to report 
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Critical Manufacturing Sector 

5. April 4, Morehead News - (Kentucky) Fire strikes ventilation system at Guardian. 
Workers at an SRG Global plant in Morehead were evacuated without incident April 4 
while firefighters battled a fire contained primarily to a rooftop ventilation system. 
Crews returned to the scene to extinguish hot spots that erupted in the plant’s duct work 
overnight April 4-5. 

Source: http://www.themoreheadnews.com/news/fire-strikes-ventilation-svstern-at- 
guardian/article 6cl89da6-daf3-l Ie4-bc6b-3flc99905a4d.html 

6. April 2, U.S. Department of Labor - (Kansas) Aluminum foundry exposes workers to 
chlorine gas and other hazards. The Occupational Safety and Health Administration 
issued 31 serious health and safety citations to Prescott-based Custom Alloy Sales 34P 
LLC April 2 after investigators discovered that the company failed to train workers on 
how to properly handle and store chlorine gas used to forge blocks of metal material, 
putting them at risk of exposure. Proposed fines total $160,200. 

Source: https://www.osha.gov/newsrelease/reg7-20150402A.html 
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Defense Industrial Base Sector 

Nothing to report 



T Return to top i 



Financial Services Sector 

7. April 6, Softpedia - (California) American Express card info exposed to 
cybercriminals. A law enforcement investigation revealed that financial and personal 
information, including the Social Security numbers of at least 500 California residents 
was revealed to unauthorized persons. The company notified affected account holders 
while authorities investigate the circumstances surrounding the breach. 

Source: http://news.softpedia.com/news/American-Express-Card-Info-Exposed-to- 
C ybercriminals -47 7550. shtml 

8. April 4, Norfolk Virginian- Pilot - (Virginia) Va. Beach employee had accidental 
access to millions. The city of Virginia Beach revealed a potential security breach 
April 3 in which Bank of America gave a city employee setting up a petty cash and 
small expenses account access to nine municipal bank accounts containing millions of 
dollars for 5-6 years. Authorities do not suspect that any of the accounts were 
compromised. 

Source: http://hamptonroads.com/2015/04/va-beach-reports-banks-securitv-breach 
April 4, Associated Press - (Rhode Island) Police: Men stole more than $65,000 from 
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9 . 



ATM. Warwick police arrested 2 suspects April 4 who allegedly skimmed more than 
$65,000 from a Greenwood Credit Union ATM in March affecting more than 125 
credit union customers. Authorities believe that the pair may have skimmed other East 
Coast ATMs. 

Source: http://www.boston.com/news/local/rhode-island/2015/04/04/warwick-police- 
arrest-from-nyc-atm-skimming-case/HClbuCi3BTQDglmvut72sJ/storv.html 

10. April 3, KTVB 7 Boise - (Idaho ) Boise police see flurry of credit card and retail 
fraud cases. Boise police reported April 3 that 7 suspects from 4 different traveling 
credit fraud groups were arrested beginning March 27. Investigators recovered over 
$33,000 in illegally obtained merchandise and approximately 156 fraudulent credit 
cards after retail employees reported suspicious activity to authorities. 

Source: http://www.ktvb.corn/storv/news/crime/2015/04/03/boise-police-see-flurrv-of- 
credit-card-and-retail-fraud-cases/25 2745 6 1 / 
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Transportation Systems Sector 

11. April 6, WGAL 8 Lancaster - (Pennsylvania) Interstate 81 crash kills 3. A portion of 
Interstate 8 1 in Franklin County was closed for more than 3 hours April 5 after a 
vehicle traveling northbound crossed the median into southbound traffic leading to a 
head-on collision that killed 3 individuals and injured 1 other. 

Source: http://www.wgal.com/news/crash-closes-section-of-interstate-81/32200124 

12. April 4, KGO 7 San Francisco - (California) Lanes of Highway 101 in San Jose 
reopen following fatal crash. All lanes of southbound U.S. Highway 101 in San Jose 
reopened after they were closed for more than 6 hours April 4 while crews cleared the 
scene after a pedestrian crossing the freeway was fatally struck by a car. A passenger in 
the vehicle suffered minor injuries. 

Source: http://abc7news.com/news/lanes-of-highwav-101-in-san-iose-reopen- 
following-fatal-crash/623494/ 

13. April 4, Seattle Times - (Washington) Structural damage closes White River bridge. 
The White River bridge on Highway 410 between Enumclaw and Buckley was closed 
for emergency repairs April 4 following a routine inspection by the Washington 
Department of Transportation that revealed damage to an overhead support structure 
caused when it was struck by an oversized load. The closure was expected to last 
several days and repairs are estimated to cost about $200,000. 

Source: http://www.seattletimes.com/seattle-news/transportation/structural-damage- 
closes-white-river-bridge/ 

14. April 3, Ann Arbor News - (Michigan) Woman accused of embezzling $60,000 from 
Saline post office. A former clerk at the U.S. Post Office in Saline was charged in 
federal court during the week of March 30 for allegedly embezzling an estimated 
$60,000 from the branch between April-December 2014. Federal officials launched an 
investigation after irregularities with banking activity were detected. 
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Source: http://www.mlive.com/news/ann- 

arbor/index.ssf/20 15/04/woman accused of embezzling 60.html 
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Food and Agriculture Sector 

15. April 4, KTOV 6 Tulsa - (Oklahoma) Blue Bell suspends Broken Arrow operations 
after contamination found. Blue Bell Creameries reported April 3 the voluntary 
closure of its Broken Arrow, Oklahoma manufacturing facility in response to Listeria 
monocytogenes contamination found in its ice cream products during a March 22 
product test performed by the Kansas Department of Health & Environment. 
Operations at the plant were expected to be suspended for about one week while the 
company inspects the plant and makes all necessary improvements. 

Source: http://www.newson6.com/story/28718080/blue-bell-suspends-operations-in- 
broken-arrow-after-contamination-found 



16. April 4, KSHB 41 Kansas City - (Kansas) Kansas Department of Agriculture lifts 
poultry quarantine order in Leavenworth, Wyandotte counties. The Kansas 
Department of Agriculture lifted its poultry quarantine order in Leavenworth and 
Wyandotte counties April 4, allowing the movement of live poultry and poultry 
products to resume. The order was lifted after tests yielded negative results during 7 
sick bird calls in the State. 

Source: http://www.kshb.com/news/kansas-department-of-agriculture-lifts-poultrv- 
quarantine-order-in-leavenworth-wyandotte-counties 

17. April 4, Associated Press - (Oklahoma) Oklahoma poultry owners urged to increase 
health safety. The Oklahoma Department of Agriculture, Food and Forestry 
encouraged owners of domestic bird and poultry April 3 to implement additional 
biosecurity precautions and to avoid contact with sick or dead poultry or wildlife after 
to two new strains of avian influenza were detected in flocks. The agency also advised 
all bird owners to report sick birds or unusual bird deaths to State and Federal officials. 
Source: http://www.charlotteobserver.com/living/health-family/articlel7398655.html 

18. April 3, U.S. Food and Drug Administration - (Massachusetts) Massachusetts dairy 
operation agrees to permanent injunction to prevent illegal drug residues in 
animals sold for food. The U.S. District Court for the District of Massachusetts on 
behalf of the U.S. Food and Drug Administration filed a consent decree of permanent 
injunction against the Michael P. Ferry, Inc. dairy operation in Westport April 3 after a 
June 2014 inspection revealed that the dairy operation violated several federal food 
laws. The dairy farm agreed to halt sales of animals for human consumption until a new 
record-keeping system is in place to track animals that have been treated with drugs 
and ensure that drug treatments are administered in a proper way. 

Source: 

http://www.fda.gov/NewsEvents/Newsroom/PressAnnouncements/ucm441 113.htm 

19. April 3, Associated Press - (Arizona) Arizona winery's food permit suspended after 
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salmonella outbreak. The Pinal County Public Health Services District temporarily 
suspended the food permit of the Windmill Winery in Florence, Arizona, April 3 
following a Salmonella outbreak linked to a March 19 wedding that sickened at least 22 
people. Health officials initiated an investigation into the winery’s food practices and 
determined that the operators exceeded their legally allowable level of food preparation 
and used a non-permitted caterer. 

Source: http://ktar.com/22/1822426/Arizona-winervs-food-permit-suspended-after- 
salmonella-outbreak 



20. April 3, U.S. Food and Drug Administration - (Virginia; Maryland) Henry’s Farm 
Inc. recalls soybean sprouts due to possible health risk. The U.S. Food and Drug 
Administration reported April 3 that Henry’s Farm Inc., recalled all packages of its 
soybean sprouts sold in 1 -pound and 10-pound bags due to possible Listeria 
monocytogenes contamination. The recalled products were distributed to retailers in 
Virginia and Maryland. 

Source: http://www.fda.gov/Safety/Recalls/ucm441216.htm 
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Water and Wastewater Systems Sector 

21 .April 5, WXXI 21 Rochester - (New York) Sewage overflow in Perry Ends. Heavy 
rain and melting snow led to a discharge of an estimated 90,000 gallons of untreated 
sewage into the Silver Lake Outlet from the sewage treatment plant in Perry, New 
York, April 4. Officials reported to the site to evaluate the extent of the damage. 
Source: http://wxxinews.org/post/sewage-overflow-perrv-ends 

For additional stories, see items 1 and 2 
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Healthcare and Public Health Sector 

22. April 4, Missoula Missoulian - (Montana) Hackers accessed patients’ credit card 
information, Western Montana Clinic says. Western Montana Clinic in Missoula 
reported April 4 that full credit card information for 44 patients and demographic and 
partial credit card information for 6,994 patients was available to hackers who accessed 
the clinic’s Web site March 10 - March 14. The hackers were searching for site 
vulnerability in the breach and blocked access to the Web site while rerouting users to a 
separate page. 

Source: http://missoulian.com/news/local/hackers-accessed-patients-credit-card- 
information-westem-montana-clinic-says/article a2410583-b3bd-5cf8-afcb- 
8d65828fc2c0.html 
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Government Facilities Sector 



23. April 4, KDKA 2 Pittsburgh - (Pennsylvania) Classes cancelled after fire damages 
Rogers Elementary School. An April 4 fire that began in the boiler room of Rogers 
Elementary School in Pittsburgh prompted officials to cancel classes April 7 after 
power and water were shut off to the building. Authorities are investigating the 
incident. 

Source: http://pittsburgh.cbslocal.com/2015/04/Q4/classes-cancelled-after-fire- 
damages-roger-elementary-school/ 

24. April 3, Al.com - (Alabama) 370,000 current, former Auburn students had personal 
data exposed on website, university says. Auburn University in Alabama announced 
April 3 that the personal information of about 370,000 current, former, and prospective 
students may have been exposed after the university learned March 2 that some 
information stored on the school’s servers inadvertently became accessible online 
between September 1, 2014 and March 2, 2015. Officials reported that there was no 
evidence that the information was misused and that corrective actions were taken to 
secure the information. 

Source: 

http://www.al.com/news/index.ssf/2015/04/370000 current former students.html 
For another story, see item 3 



[ Return to top ] 

Emergency Services Sector 

25. April 5, Associated Press - (Illinois) Aunt of captured inmate charged with aiding 
in escape. An inmate who escaped from the Jerome Combs Detention Center in 
Kankakee April 1 after beating, choking, and stealing a guard’s uniform was recaptured 
April 3 in Chicago. The inmate’s aunt was also charged for allegedly aiding the inmate 
in his escape by giving him information on the jail where she was once employed. 
Source: http://www.msn.com/en-us/news/crime/aunt-of-captured-inmate-charged-with- 
aiding-in-escape/ar-AAar3ZZ 

26. April 5, Nashville Tennessean - (Tennessee) Escaped Williamson County teens 
surrender. The Fran kl in Police Department announced April 5 that two inmates who 
assaulted officers and escaped from the Williamson County Juvenile Detention facility 
in Tennessee April 2 were in custody after surrendering to police. 

Source: http://www.tennessean.com/storv/news/crime/2015/04/05/escaped-williamson- 
county-teens-surrender/25325595/ 

27. April 4, Philadelphia Inquirer - (Pennsylvania; Florida) Fire Dept, alerts ambulance 
patients to data breach. The Philadelphia Fire Department announced April 4 that the 
personal and billing information, including Social Security numbers, of at least 750 
patients who used its ambulances were stolen by an employee of Intermedix, a third- 
party company that handles the data. Police in Opa-Focka, Florida, arrested an 
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individual in February in possession of the patients’ information. 

Source: 

http://www.phillv.com/philly/news/20150404 Fire Dept alerts ambulance patients 
to data breach.html 



28. April 4, WKRN 2 Nashville - (Kentucky) 3 inmates escape from Kentucky jail. 
Kentucky State Police are searching for three inmates who walked away from a 
Marshall County jail in Benton April 3. 

Source: http ://w ate .com/20 1 5/04/04/3-inmates-escape-fro-m-kentucky-i ail / 
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Information Technology Sector 

29. April 6, Softpedia - (International) Google certificate expires, email clients 
return security warnings. An expired intermediate certificate signed by Google 
Internet Authority G2 for simple mail transport protocol (SMTP) in Google’s Gmail 
resulted in users receiving error messages on outgoing email activity for over 2 
hours April 4. The company renewed the certificate through December 2015. 

Source: http://news.softpedia.com/news/Google-Certificate-Expires-Email-Clients- 
Return-Securitv-Wamings-477700.shtml 

30. April 6, Securityweek - (International) Flaw in Schneider Electric vamp software 
allows arbitrary code execution. The Industrial Control Systems Cyber Emergency 
Response Team (ICS-CERT) released an advisory stating that Schneider Electric’s 
VAMPSET software is vulnerable to stack-based and heap-based buffer overflow 
attacks that can be exploited to execute arbitrary code via malformed VAMPSET 
disturbance recording files on the affected systems. The company released an update 
fixing the issue and advised organizations that use the software to leverage User 
Access Control (UAC) features and employ best security practices. 

Source: http://www.securitvweek.com/flaw-schneider-electric-vamp-software-allows- 
arbitrary-code-execution 



31 .April 4, Softpedia - (International) WordPress, Joomla sites infected with 

malicious Flash file. Security researchers at Sucuri discovered that several hundred 
Web sites running WordPress or Joomla content management systems (CMS) have 
been attacked since November 2014 with malicious one-pixel-large small web format 
(SWF) files containing hidden iframe code that directs users to Web sites hosting 
malware such as exploit kits. 

Source: http://news.softpedia.com/news/WordPress-Joomla-Sites-Infected-with- 
Malicious-Flash-File-477597 .shtml 



32. April 3, Softpedia - (International) New MS Word exploit kit adds statistics tool to 
track success of the campaign. Security researchers at FireEye discovered a Web- 
based tool called MWISTAT released in December 2014 that allows cybercriminals 
using the Microsoft Word Intruder (MWI) exploit kit to track details about rigged 
Microsoft Word documents including Internet Protocol (IP) addresses and user-agents 
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of victims, payloads requested and served, and the version of Microsoft Word used to 
open the file. The malware has reportedly affected over 1400 users worldwide in 2 
separate spam campaigns. 

Source: http://news.softpedia.com/news/New-MS-Word-Exploit-Kit-Adds-Statistics- 
Tool-to-Track-Success-of-the-Campaign-477568.shtml 

Internet Alert Dashboard 



To report cyber infrastructure incidents or to request information, please contact US-CERT at soc@us-cert.gov or 
visit their Web site: http://www.us-cert.gov 

Information on IT information sharing and analysis can be found at the IT ISAC (Information Sharing and 
Analysis Center) Web site: http://www.it-isac.org 
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Communications Sector 



33. April 3, Associated Press; Washington Times - (New Mexico) Cable cut partially 
interrupts phone service in Gallup area. Telephone, cell phone, and Internet service 
was restored to an unspecified number of CenturyLink and Sacred Wind 
Communications customers near Gallup, New Mexico, after a driver struck an above- 
ground fiber-optic cable and knocked out service for about 8 hours April 3. Technicians 
were dispatched to splice and repair the severed cable. 

Source: http://www.washingtontimes.com/news/2015/apr/3/cable-cut-partiallv- 
interrupts-phone-service-in-ga/ 

34. April 3, KRDO 13 Colorado Springs - (Colorado) Phone, Internet outage affects 
hundreds of Pueblo customers, city departments. Phone and Internet service for 
hundreds of CenturyLink customers in the City of Pueblo was down April 3 after a 
contractor inadvertently drilled a hole into fiber cables that service CenturyLink and the 
city’s fiber infrastructure network. Lull restoration of services was expected to take 
several days while crews work to resolve the problem. 

Source: http://www.chieftain.com/business/localbusiness/3486640-120/departments- 
phone-accident-affected 
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Commercial Facilities Sector 

35. April 5, Chicago Sun-Times - (Illinois) Evanston Burger King evacuated after car 
strikes building’s gas meter. A Burger King in Evanston was evacuated and closed 
for approximately 5 hours April 5 after a car struck a gas meter attached to the 
restaurant and released gas. The meter was repaired and the restaurant was reopened. 
Source: http://chicago.cbslocal.com/2015/04/05/evanston-burger-king-evacuated-after- 
car-strikes-buildings-gas-meter/ 

36. April 5, KSTU 13 Salt Lake City - (Utah) Evacuations lifted after bomb threat in 
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Park City impacted about 45 homes and businesses. About 45 businesses and homes 
were evacuated in Park City, Utah, for approximately 4 hours April 5 while police 
investigated a bomb threat at the Treasure Mountain Inn. The evacuation was lifted 
after a nothing suspicious was found at the inn. 

Source: http ://fox 1 3no w .com/20 1 5/04/05/heav v-police-response-in-park-city- 
restaurant-evacuated-after-report-of-bomb-threat/ 

37. April 5, KCCI 8 Des Moines - (Iowa) More than 20 families displaced by apartment 
fire. An April 4 fire at the Eastridge Apartments in Des Moines left 24 families 
displaced and caused between $300,000 and $400,000 in damages. Authorities are 
investigating the cause of the fire. 

Source: http://www.kcci.com/news/crews-on-the-scene-of-apartment-complex- 
fire/32 194646 



38. April 5, Associated Press; WCBS 2 New York City - (New Jersey) Authorities: 14 
hurt in ceiling collapse at Rahway Church. Fourteen people were injured after the 
ceiling of the Korean Union United Methodist Church in Rahway, New Jersey, 
collapsed April 5. Authorities are investigating the cause of the collapse and the total 
amount of damage in order to determine when the church will reopen. 

Source: http://newvork.cbslocal.com/2015/04/05/several-hurt-in-possible-roof- 
collapse-at-rahway-church/ 

39. April 3, KTVI 2 St. Louis - (Missouri) Power outage shuts down Six Flags St. Louis 
Friday. Six Flags St. Fouis reopened April 4 after closing April 3 when electricity 
went out at the amusement park due to an issue with an underground fault or power 
line. Riders were manually escorted off rides. 

Source: http://fox2now.com/2015/04/03/power-outage-closes-six-flags-st-louis-people- 
escorted-off-rides/ 
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Dams Sector 



Nothing to report 
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NTAS 



NO ACTIVE ALERTS 
www.DHS.gov/alerts 
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http://www.dhs.gov/IPDailyReport 

Contact Information 

Content and Suggestions: Send mail to cikr.productfeedback@hq.dhs.gov or contact the DHS 
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Contact DHS 

To report physical infrastructure incidents or to request information, please contact the National Infrastructure 
Coordinating Center at nicc@hq.dhs.gov or (202) 282-9201. 

To report cyber infrastructure incidents or to request information, please contact US -CERT at soc@us-cert.gov or visit 
their Web page at www.us-cert.gov . 

Department of Homeland Security Disclaimer 

The DHS Daily Open Source Infrastructure Report is a non-commercial publication intended to educate and inform 
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restrictions. DHS provides no warranty of ownership of the copyright, or accuracy with respect to the original source 
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